Security You Should Know

In this episode, Tom Findling, CEO and co-founder at Conifers, explains how Conifers adds an operating layer between a security team's existing tools and its people. That layer connects threat intelligence, hunting, detection engineering, investigation, and response so the SOC can respond, adapt, and detect at machine speed, with the transparency and guardrails that let teams build trust over time. It does not replace the SIEM or any existing controls. Joining him are Jake Lorz, vp of information technology and CISO at Cintas, and Dennis Pickett, vp and CISO at RTI International.

Want to know:

• Are SOCs built for human speed really putting defenders at a disadvantage?
• Why would you choose Conifers over the AI features platforms are building into their own products?
• Where do customers draw the line on autonomy: investigation, containment, or remediation?
• How does the system fail safe when an AI hallucination happens?
• Does the platform rely only on alerts from your existing tools, or does it run its own analysis?
• Why do so many detections in large enterprises stop working when the underlying telemetry shifts?
• How do you keep AI-generated detections from burying the SOC in more alert noise?
• What does it take to give an AI agent a longer leash without losing trust in its decisions?
• How long does it take to see value in a large environment?

Check out the episode for the answers you need.

Huge thanks to our sponsor, Conifers

Conifers builds CognitiveSOC™, the agentic AI SOC platform that powers Resilient Cyber Defense. It investigates with your environment's context and shows the evidence behind every conclusion, connecting threat intelligence, threat hunting, detection engineering, investigation, and remediation as one adaptive system on top of the security tools you already own.

In this episode, Michal Jankech, vice president, enterprise, SMB & MSP at ESET, explains why the company believes the future of defense will be supervised, not fully autonomous. ESET uses AI to supercharge its human analysts in delivering 24/7 managed detection and response, with AI suggesting and humans making the final call. When an attack is underway, the service isolates the host and handles remediation. ESET also extends protection into the AI era by monitoring AI agents' behavior, scanning the skill files they download, and inspecting conversations between employees and chatbots through a browser extension. Joining him are Bozidar Spirovski, CISO at Blue dot, and Nick Espinosa, host of The Deep Dive Radio Show.

Want to know:

• Why does AI favor whoever has the cheaper feedback loop, and what does that mean for defenders?
• How do you trust a security vendor that uses AI to detect AI?
• How do you discover locally built agents that aren't even shadow AI?
• Why is feature parity across Windows, Mac, and Linux a promise no vendor can keep?
• What should stay human as AI takes on more of the analysis?
• How do you keep both MDR analysts and customers from drowning in alerts?
• Why is the line between prevention and detection disappearing?
• What does a security service look like for small businesses that have no CISO?

Check out the episode for the answers you need.

Huge thanks to our episode sponsor, ESET

Your teams are adopting AI faster than security keeps up. ESET helps you embrace it safely. Confident AI adoption starts with proactive protection and effortless security management: AI-powered prevention stopping threats early, expert MDR watching 24/7, and one platform that's simple to run. Get to know the new ESET PROTECT Platform - designed for the AI era.

In this episode, Joshua Knox, Principal Cybersecurity Strategist and AI Lab Tech Lead at Horizon3, explains how the company's NodeZero platform runs continuous, autonomous offensive assessments that surface exploitable attack chains and dangerous misconfigurations, not just vulnerabilities, so teams can prioritize and validate fixes on a repeatable basis. Joining him are Jesse Webb, CISO and SVP of Information Systems at Avalon Healthcare Solutions, and Ryan Brown, Director and Head of Cybersecurity Operations at Children's National Hospital.

Want to know:

• Why are vulnerability scanners disrupting security programs, and is it really disruption or a prioritization problem?
• How does NodeZero scope an assessment so it doesn't put patient-connected medical devices at risk?
• Can NodeZero identify the criticality of a specific device, like a PACS machine, once it's discovered on the network?
• How does Horizon3 keep HIPAA data "production safe" when NodeZero is actively assessing a healthcare network?
• Why does running attacks through code-bound modules, rather than a freeform agent, make autonomous pentesting more reliable?
• How do autonomous pentest reports hold up as an audit artifact next to a traditional, human-led penetration test?
• What happens when a legacy contract requires a human-proctored external pentest?
• How does Horizon3 train its models without using data from customer environments?
• What's the one thing about NodeZero that surprises CISOs most once they start using it?

Huge thanks to our sponsor, Horizon3

Horizon3 is the AI-native proactive security company behind NodeZero®, an autonomous pentesting platform that helps organizations prove their defenses work. NodeZero safely identifies exploitable attack paths, verifies fixes, and enables continuous security validation at machine speed so teams can stay ahead of AI-powered threats.

In this episode, Ashu Savani, co-founder of TryHackMe, explains how the company's Live Breach product puts teams inside fully-executed, realistic breach simulations built around the threat actors and tech stacks they face, building the reflexes and reporting security leaders need before a real incident hits. Joining him are Roland Toussaint, Senior Director of Incident Response and Security Engineering at ChenMed, and Heather Hinton, CISO at Sitecore.

Want to know:

• How can a simulated environment realistically reflect a security team's actual tech stack and the threat actors they care about?
• Can TryHackMe's reporting help security leaders prove upskilling progress to auditors and cyber insurance carriers?
• How does TryHackMe help teams train for incidents caused by their own people, not just outside attackers?
• How granular can training get: can a team run a meaningful exercise in just 15 to 20 minutes?
• How are TryHackMe's custom exercises tiered and packaged across its plans?
• What's TryHackMe's track record getting cyber insurance carriers to accept its exercises as sufficient proof of readiness?
• Does TryHackMe offer anything built specifically around HIPAA for healthcare organizations?
• Why is crisis communication often more under-rehearsed than technical response, and how does TryHackMe help teams practice it?

Check out the episode for the answers you need.

Huge thanks to our sponsor, TryHackMe

Live Breach challenges security teams to test their incident response against a rogue AI agent in a realistic, three-hour exercise. The campaign uses a compelling AI-driven attack scenario to create urgency, while highlighting the low-risk setup, actionable readiness insights and practical value of testing teams before a real incident occurs. Business applicants only, 18+. Applications open 7 October 2026 and close 18 October 2026 at 23:59 EST time. Six companies are selected by a TryHackMe panel from eligible applications, against published criteria; each receives one complimentary simulated Live Breach exercise. No purchase necessary. Full terms: http://tryhackme.com/legal/live-breach-giveaway-terms

In this episode, Joseph Perla, founder and CEO at TrustedRouter, explains how his company's confidential-computing-based LLM router lets teams send prompts to hundreds of AI models while cryptographically verifying, rather than simply trusting, that no one, including TrustedRouter itself, can see the data passing through. Joining him are TC Niedzialkowski, former head of IT & security at Opendoor, and Keith McCartney, svp of security and IT at DNAnexus.

Want to know:

• Why hasn't the AI privacy problem already been solved, given how many tools and architectures already exist?
• What's wrong with the "zero data retention" promises most AI providers offer today?
• How does a confidential virtual machine let a company verify, instead of just trust, that its own router isn't looking at its prompts?
• For a use case like HIPAA-covered medical data, does TrustedRouter provide one complete, auditable path from a user's machine to the model and back?
• How does remote attestation confirm end-to-end encryption down to the chip level?
• Does TrustedRouter's SOC 2 Type 2 attestation cover the AI workload itself, or just its own SaaS interface?
• Can customers restrict which data centers or jurisdictions their AI workloads run in?
• What happens to a company's existing AI usage monitoring once it starts routing through TrustedRouter?

Check out the episode for the answers you need.

Huge thanks to our sponsor, TrustedRouter

TrustedRouter is the open-source AI gateway for teams that need privacy with proof. It routes hundreds of models through attested confidential compute, keeps prompts and outputs out of logs, verifies the code handling each request, and adds provider failover, spend controls, and OpenAI-compatible APIs for production AI systems.

In this episode, Dean Shroll, senior director of sales engineering at ThreatDown, explains how the company's Nebula and OneView consoles simplify protection across Mac, Linux, and Windows endpoints while its managed detection and response team absorbs the 24/7 monitoring that resource-constrained teams can't staff on their own. Joining him are Jonathan Waldrop, CISO at Acoustic, and Arif Hameed, CISO at C&R Software.

Want to know:

• Why is managing security for resource-constrained organizations suddenly getting more attention?
• How does ThreatDown keep its console simple without sacrificing depth across Windows, Mac, Linux, and cloud environments?
• Where does ThreatDown draw the line between what it automates and what still needs a human analyst?
• How does the platform distinguish suspicious behavior from normal DevOps activity without drowning teams in false positives?
• What guardrails exist to stop overly broad exclusions from opening up a device?
• Who owns what when an MDR provider is involved, and where does that responsibility actually end?
• How should a CISO justify an MDR investment to the board when nothing bad happens?

Check out the episode for the answers you need.

Huge thanks to our sponsor, ThreatDown

ThreatDown delivers elite Managed Detection and Response purpose-built for resource-constrained teams with high-efficacy protection without complexity. Combining artificial intelligence and expert analyst judgment, ThreatDown intercepts sophisticated attacks with speed and accuracy, scaling security effortlessly. Recognized by MRG Effitas, AVLab, and G2, ditch fragmented tools for fast, 24/7 protection without overhead.

In this episode, Leo Taddeo, CEO and President at AppGate, explains how the company's zero trust network access platform cloaks internet-facing infrastructure from discovery, uses direct-routed architecture instead of cloud-routed hairpinning to avoid the latency tax, and layers in continuous, context-aware policy checks that go beyond device posture and MFA. Joining him are Ross Young, co-host of CISO Tradecraft, and Derek Fisher, Director of the Cyber Defense and Information Assurance Program at Temple University.

Want to know:

• Why does securing remote access remain one of the top attack vectors year after year?
• How does AppGate's direct-routed architecture avoid the latency and throughput limits of cloud-routed competitors?
• What happens to a user's access when the circumstances that justified it change, like a closed service ticket?
• How does cloaking network infrastructure stop an adversary's reconnaissance before it starts?
• What's the fallback when a controller hosted in a customer's own data center goes down?
• How does AppGate defend against credential replay and man-in-the-middle attacks that bypass MFA entirely?
• What does AppGate's per-user licensing model mean for organizations managing multiple devices and enclaves?

Check out the episode for the answers you need.

Huge thanks to our sponsor, AppGate

AppGate secures and protects an organization's most valuable assets with its high performance Zero Trust Network Access (ZTNA) solution. AppGate ZTNA is the only direct-routed Zero Trust solution built for peak performance, superior protection and seamless interoperability. AppGate safeguards enterprises and government agencies worldwide. Learn more at appgate.com.

In this episode, Sagar Batchu, CEO of Speakeasy, explains how the Speakeasy AI control plane lets organizations adopt AI everywhere and still prove it's governed — putting every agent, tool, and MCP server behind a single security layer that authenticates each action, enforces policy, and inspects every session for prompt injection and data exfiltration. Pressure-testing the approach are George Finney, CISO at The University of Texas System, and Nick Espinosa, host of The Deep Dive Radio Show.

Want to know:

• Why is knowing what your AI agent can access still an unsolved problem, and how much of it traces back to the identity and data governance we never fixed for humans?
• Should an AI agent ever be allowed to take an action no individual can fully understand, even when it's statistically more effective than the human alternative?
• Where's the line between legitimate governance and surveillance, and how do you assure employees you're not building a panopticon?
• Are there decisions and departments that should stay permanently in human hands, off-limits to agents entirely?
• When an agent acts through a company's API and something goes wrong, who's actually responsible: the employee, the company, the model developer, the API provider, or the governance platform?
• Could a control plane have flagged the week's biggest AI incident before it escalated?
• Is adopting this really as simple as switching on enterprise settings and plugging in an API, whether you're an SMB or the Fortune 1?
• What is "cognitive surrender," and why does Speakeasy's CEO think it's the one quality companies most need to protect?

Check out the episode for the answers you need.

A huge thanks to our sponsor, Speakeasy.

Speakeasy is the enterprise AI control plane. It governs every AI agent, tool, and MCP server from one place. Every connection is authenticated, every policy enforced, and every agentic action inspected and logged. So organizations can scale AI adoption with visibility and control. Copy for below Banner: AI usage is outgrowing your enterprise controls. Speakeasy is the AI control plane that governs every agent, assistant, and MCP server from one layer. Each connection is authenticated, each policy enforced, and every action recorded. So you stay in control as AI adoption scales."

In this episode, Curtis Simpson, CSO at Gambit Security, explains how Gambit moves organizations past that guesswork by continuously mapping a company's minimally viable business capabilities and validating whether the infrastructure, backups, and recovery processes behind them can actually deliver within the timeframes the business requires. Joining him to pressure-test the approach are Howard Holton, former CEO of GigaOm, and Adam Palmer, CISO at First Hawaiian Bank.

Want to know:

• Why do so many disaster recovery plans hold up on paper but fail the moment they're actually needed?
• What's the real difference between having something backed up and proving you can recover it?
• What is a "minimally viable company," and how much of mapping it is automated versus built on human input?
• What happens when your infrastructure fails today, versus what Gambit's roadmap has planned for tomorrow?
• What should actually land in front of your CEO or board to demonstrate recovery confidence?
• Is there an organization too small, or too mature, to get value from this kind of resilience assessment?
• Why does decades-old infrastructure like the mainframe often cause the longest, most damaging outages?
• Why is now the moment for security to finally move from a "trust but trust" model to "trust but verify" on recoverability?

Check out the episode for the answers you need.

Huge thanks to our sponsor, Gambit Security

Gambit is the AI-native cyber resilience platform for enterprises that can't afford downtime. It continuously maps your live environment, backups, security tools, and infrastructure-as-code, then validates whether your entire stack can actually recover from disruption. Gambit gives security and infrastructure leaders proof of recoverability on demand, so the business keeps running. Balens maps, controls, and proves your recoverability across every layer of your stack - against infrastructure failures, human and AI errors, and cyber threats. One live view of your cloud, IaC, and backups that updates as your environment evolves. Agentless deployment in 15 minutes. Learn more at gambit.security

In this episode, Andrea Sivieri, Chief Product and Technology Officer at CoreView, explains how CoreView secures that overlooked layer, the configuration, permissions, and structure of a Microsoft 365 tenant rather than just the data flowing through it. Joining him are Davi Ottenheimer, principal at Flying Penguin, and Will Gregorian, CISO at Galileo Medical.

Want to know:

• Why does Microsoft's own admin console give you roughly a thousand ways to configure a single setting?
• What's the actual difference between securing your Microsoft 365 data and securing your Microsoft 365 configuration?
• How does a "virtual tenant" stop one compromised admin account from exposing your entire company?
• How do you stay ahead of a vendor that can change its APIs or shut off access without warning?
• How do you catch a change to your tenant that you had no way of seeing in the first place?
• How far back can you rewind a tenant's configuration history, and why does that number matter?
• What does managing a 2.7 million-user tenant reveal about resilience that a small business never has to think about?

Check out the episode for the answers you need.

A huge thanks to our sponsor, CoreView